FedRAMP Security & Compliance Lead

CGC; McLean, Northern (VA, KY); Hybrid; USD 120,000 - 180,000; Full time

Job summary

Merlin Group in McLean, VA seeks an Information Systems Security Manager to own day-to-day security compliance, FedRAMP authorization maintenance, and program management of security controls. You will coordinate access authorization, vulnerability scanning, POA&M, and change control while translating requirements for engineering and SOC teams.

The role emphasizes clear communication with customers and leadership, proactive risk reporting, and adherence to compliance calendars.

Qualifications

• 5+ years as an ISSM in FedRAMP environments with CSPs.
• Hands-on FedRAMP Rev 5, 20x, and CR26 experience, translating controls for engineering/SOC teams.
• Hands-on vulnerability management, POA&M, and change control in regulated settings.
• Strong organization for a large recurring compliance calendar with deadlines.
• Judgment to raise risks early, not after issues become critical.
• Ability to communicate clearly with technical, customer, and leadership audiences.

Responsibilities

• Coordinate access authorization and maintain tracked reviews.
• Manage POA&M status, owners, and remediation plans with teams.
• Perform vulnerability scanning analysis and reporting for stakeholders.
• Oversee Change Control Board and Security Impact Assessments for changes.
• Coordinate major changes through review/approval processes.
• Track recurring compliance calendar (IRCP, contingency tests, ROB).
• Coordinate SBOM submissions and LMS for security training.
• Monitor FedRAMP program changes and assess impact.

Skills

ISSM FedRAMP experience

FedRAMP Rev 5/20x/CR26

Vulnerability management

POA&M processes

Change control

CSP collaboration

Stakeholder communication

Job description

Merlin Group in McLean, VA seeks an Information Systems Security Manager to own day-to-day security compliance, FedRAMP authorization maintenance, and program management of security controls. You will coordinate access authorization, vulnerability scanning, POA&M, and change control while translating requirements for engineering and SOC teams.

The role emphasizes clear communication with customers and leadership, proactive risk reporting, and adherence to compliance calendars.